CVE-2019-16200

GNU Serveez 0.2.2 and earlier: information disclosure via HTTP POST to /cgi-bin/reader. A crafted Content-Length (positive value whose 32‑bit binary representation is negative) triggers a heap‑based over-read, with the code path in http_cgi_write (http-cgi.c) and potentially svz_envblock_add (lib...